Title
by Ron Lepofsky
The Manager’s Guide to Web Application Security: A Concise Guide to the Weaker Side of the Web
- Cover
- Title
- Copyright
- Dedication
- Contents at a Glance
- Contents
- About the Author
- About the Technical Reviewer
- Acknowledgments
- Introduction
- Chapter 1: Understanding IT Security Risks
- Chapter 2: Types of Web Application Security Testing
- Chapter 3: Web Application Vulnerabilities and the Damage They Can Cause
- Lack of Sufficient Authentication
- Weak Session Management
- Weak Access Control
- Weak Input Validation at the Application Level
- Redirects and Forwards to Insecure Sites
- Injection Flaws
- Unauthorized View of Data
- Web Application Source Code Disclosure
- Web Directories Enumerated
- Active Directory Object Default Page on Server
- Temporary Files Left in the Environment
- Internal IP Address Revealed by Web Server
- Server Path Disclosed
- Hidden Directory Detected
- Unencrypted VIEWSTATE
- Obsolete Web Server
- Query Parameter in SSL Request
- Error Handling
- Cross-Site Scripting Attacks
- Security Misconfigurations and Use of Known Vulnerable Components
- Denial-of-Service Attack
- Related Security Issues
- Summary
- Chapter 4: Web Application Vulnerabilities and Countermeasures
- Lack of Sufficient Authentication
- Weak Session Management
- Weak Access Control
- Weak Input Validation at the Application Level
- Redirects and Forwards to Insecure Sites
- Injection Flaws
- Unauthorized View of Data
- Web Application Source Code Disclosed
- Web Directories Enumerated
- Active Directory Object Default Page on Server
- Temporary Files Left in the Environment
- Internal IP Address Revealed by Web Server
- Server Path Disclosed
- Hidden Directory Detected
- Unencrypted VIEWSTATE
- Obsolete Web Server
- Query Parameter in SSL Request
- Error Handling
- Cross-Site Scripting Attacks
- Security Misconfigurations and Using Known Vulnerable Components
- Denial-of-Service Attack
- Related Security Issues
- Summary
- Chapter 5: How to Build Preventative Countermeasures for Web Application Vulnerabilities
- Chapter 6: How to Manage Security on Applications Written by Third Parties
- Chapter 7: Integrating Compliance with Web Application Security
- Chapter 8: How to Create a Business Case for Web Application Security
- Assessing the Risk
- Calculating Annual Loss Expectancy
- Calculating the Cost of Prevention and Remediation
- Calculating the Return on Security Investment
- Creating the Business Case for Executives
- Measuring and Cost-Justifying Residual Risk
- Determining Whether Return on Security Investment Objectives Are Met
- Summary
- Chapter 9: Parting Thoughts
- Appendix A: COBIT® 5 for Information Security
- F.3 Secure Development
- F.4 Security Assessments
- F.5 Adequately Secured and Configured Systems, Aligned With Security Requirements and Security Architecture
- F.6 User Access and Access Rights in Line With Business Requirements
- F.7 Adequate Protection Against Malware, External Attacks and Intrusion Attempts
- Appendix B: Experian EI3PA Security Assessment
- Appendix C: ISO/IEC 17799:2005 and the ISO/IEC 27000:2014 Series
- Appendix D: North American Energy Council Security Standard for Critical Infrastructure Protection (NERC CIP)
- Appendix E: NIST 800 Guidelines
- Appendix F: Payment Card Industry (PCI) Data Security Standard Template for Report on Compliance for use with PCI DSS v3.0
- Appendix G: Sarbanes-Oxley Security Compliance Requirements
- Appendix H: Sources of Information
- Index
The Manager’s Guide to Web Application Security:
A Concise Guide to the Weaker Side of the Web
Ron Lepofsky
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.